Below the Line of Visibility

Every enterprise AI system has a chat window. The chat window is the least interesting part of it. This piece is about the four rows underneath: what has to exist there, how much authority each layer is allowed to carry, and why the answer to “can we trust this” is decided entirely below the fold.

1. A forty-year-old diagram that turns out to be the right one

In January 1984, G. Lynn Shostack — then a senior executive at Bankers Trust, not a designer — published Designing Services That Deliver in the Harvard Business Review. Her complaint was that services were badly built because nobody designed them: they emerged from trial and error and from process-flow diagrams that captured the company’s systems and ignored the customer’s experience entirely.

Her answer was the service blueprint. A process map with layers, split by horizontal lines:

• Line of interaction: every crossing is a moment the customer touches the system.
• Line of visibility: above it, everything the customer perceives. Below it, everything that makes the service actually work.
• Line of internal interaction: below which sits standing capability rather than per-transaction work.

The line of visibility is the one that matters. It is precisely what separates a blueprint from a journey map: a journey map stops at the top row, which is why it is a research artifact and not something you can build from.

Forty-two years later this is the most useful available diagram for enterprise AI, for an unflattering reason. Nearly every AI deliverable being shown to enterprise buyers right now is a journey map: the top row, rendered beautifully, with nothing underneath it.

What breaks when the actor isn’t human

Shostack’s blueprint assumed two kinds of actor: the customer and the employee. Jodi Forlizzi, Herbert A. Simon Professor of HCI at Carnegie Mellon, made the necessary observation in December 2025: in agentic services, “designer, customer, and AI co-construct service delivery, and then agentic AI autonomously creates and orchestrates service actions personalized for a given customer.” She poses the open question directly: is it useful to model a process where large portions may be autonomous?

Our answer is yes, and the modification is small but consequential. Keep all four rows. Replace the backstage row’s occupants with agents. The moment you do that, the interesting question stops being what does the system do and becomes how much authority does each step carry, because a backstage row of software that acts has a property a backstage row of people never had: it needs its permissions written down.

2. The authority gradient

The most common design error in agentic systems is treating autonomy as a property of the agent. It is a property of the step.

Feng, McDonald and Zhang make this precise in Levels of Autonomy for AI Agents (arXiv:2506.12469): autonomy should be treated as a deliberate design decision, separable from capability. A highly capable agent can be deliberately constrained to consult before every action. They frame five levels by the role the human occupies (operator, collaborator, consultant, approver, observer) and propose autonomy certificates specifying the maximum level at which an agent may operate.

Subsequent enterprise governance work extends this by explicitly separating an Agent Capability Level from its allowed autonomy, with levels running from reactive execution through decision support, supervised action, goal-directed autonomy, and delegated operational authority, and demonstrating a deployed data-engineering agent assessed at high capability but deliberately held at low allowed autonomy on grounds of risk, reversibility and organizational readiness. The Cloud Security Alliance published a six-level taxonomy in January 2026 consciously echoing SAE J3016.

The practical collapse of all this into something you can put on a page is three bands:

The test for which band a step belongs in is reversibility and stakes, which are properties of the business process, knowable before you have chosen a model. How well the model performs on the step does not enter into it.

Why this maps directly onto the regulator’s list

FINRA’s 2026 Annual Regulatory Oversight Report, published December 9, 2025 and its first dedicated treatment of AI agents, names the risks as: autonomy (agents acting without human validation); scope and authority (agents acting beyond intended scope); auditability and transparency (multi-step reasoning that is difficult to reconstruct); data sensitivity; domain knowledge; and reward misalignment.

Lay that against the blueprint. The first two are the authority band. The third is the record row. The fourth is the resolution step that happens before retrieval. FINRA also now treats AI prompt and output logs as records under Rule 4511 where they are used in supervision, recommendations, or customer interactions.

The EU picture is the one most teams currently have wrong. Regulation (EU) 2026/1744 (the Digital Omnibus on AI, adopted July 8, 2026, published in the Official Journal on July 24, in force 27 July) moved Annex III high-risk obligations from August 2, 2026 to December 2, 2027, and Annex I product-embedded systems to August 2, 2028. The stated reason was the delayed availability of standards, common specifications and national competent authorities.

What did not move: Article 50 transparency obligations, which applied on August 2, 2026 as originally scheduled. And nothing about the substance of Articles 9, 12 and 26 changed: continuous risk management across the lifecycle, automatic event logging for the system’s lifetime, and a deployer duty to retain those logs for at least six months. The engineering requirement is identical; only the enforcement date moved.

Design implication: build the log now and you are compliant on either calendar. Build it in late 2027 and you will be retrofitting provenance into a system that was never structured to carry it, which is an order of magnitude more expensive.

3. The support row: what must already exist

This is the row clients cannot see and will not trust the system without. Five things belong here.

3.1 A frozen vocabulary, with provenance

The failure mode has a name: metric drift. Finance defines “active customer” one way, marketing another, and an ungoverned agent resolves the ambiguity probabilistically, inferring meaning from column names and schema patterns. Two teams, two answers, zero trust.

The measured effect is large. Omni Analytics traces text-to-SQL failure to three structural causes: domain-specific metrics the model cannot interpret, wrong joins on multi-table schemas, and non-determinism (the same question producing a different query on different runs). dbt Labs’ 2026 benchmark puts raw-schema text-to-SQL near 40% accuracy against 83% when grounded in a semantic layer, with queries fully covered by a well-modeled layer approaching 100% because deterministic query generation removes the opportunity to produce a subtly wrong result set. Snowflake reports agentic refinement of a semantic model adding roughly 20 percentage points over a vanilla LLM.

The architectural point is the division of labor: the model owns intent; the layer owns execution. The model expresses what is being asked. A deterministic compiler turns that into the query. Anything the layer cannot express leaks back into ad-hoc SQL, where drift returns.

One addition we consider non-negotiable for consulting work: the vocabulary is the client’s own, captured with provenance and amendment history rather than imposed. When a term changes meaning mid-engagement, that is recorded as a dated amendment rather than an edit, because an artifact produced under the old definition is still correct under the old definition, and you need to be able to prove which one was in force.

3.2 Answerability scoring, with reason codes

Most platforms answer the question “what can you do?” with a capability list. The useful artifact answers “what can you answer, for whom, today?”, and it is a table, not a narrative.

Every question in the inventory is scored answerable / partial / blocked, and every non-answerable score carries a machine-readable reason code naming the specific missing element: the absent source, the undefined term, the system without a read path, the position without a confirmed owner.

Three properties make this worth building rather than estimating:

1. Coverage is computed per persona and per lever, never in aggregate. Aggregate coverage is the single most misleading number in this domain. A platform at 64% overall can be at 81% for commercial operations and 19% for regulatory affairs, and the second number is what determines whether the deployment survives.
2. The blocked set, sorted by the decisions each fix releases, is the build backlog. It is derived from the inventory, never negotiated with a vendor.
3. The register is a dataset, not a document. It lands as a table in the client’s own warehouse, which means blocked queries at runtime can return a reason rather than a hallucination, and log the demand.

That last property is the one that changes system behavior. An agent that knows what it cannot answer is categorically different from one that always produces something.

3.3 A verification chain that survives being checked

“It has a citation” is not the bar. The Stanford RegLab work is the clearest available evidence on why.

Large Legal Fictions (Dahl, Magesh, Suzgun and Ho) tested more than 200,000 queries against each of GPT-3.5, Llama 2 and PaLM 2, and found hallucination rates ranging from 69% to 88% on specific legal queries. The follow-up, Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools (Magesh et al.), was preregistered and hand-scored across 202 queries against purpose-built RAG products: Lexis+ AI at 17% hallucination, Westlaw AI-Assisted Research at 33%, Ask Practical Law AI at 17% hallucinated but 62% incomplete.

RAG helps enormously. RAG does not solve it. And the study’s most important finding got the least attention: misgrounding, a real, correctly-formatted citation to a source that does not support the claim made. The researchers describe it as more dangerous than outright fabrication precisely because it is subtler and harder to spot. Documented failure modes include misunderstanding holdings, confusing litigant arguments with court opinions, misrepresenting which court controls, and attributing dissenting views to the majority. A fabricated citation fails the first check. A misgrounded one passes it.

The design consequence: the verification step must confirm that the cited source says what the claim says, against an approved position with a named owner and a date, not merely that a document exists at the other end of the link. And where sources conflict, the conflict is surfaced rather than smoothed. A system that silently picks a side has destroyed the information the reviewer most needed.

The same body of work flags sycophancy: when a prompt contains a false premise, most tools reinforce it rather than correcting it. Any question-answering surface for regulated work needs an explicit path for “the premise of this question is wrong.”

3.4 A record where time is a first-class dimension

Most systems answer “what is true.” Regulated work requires “what was true, when, and what did we believe at the time.”

That is a bitemporal model, formalized in SQL:2011: every fact carries valid time (when it was true in the world) and transaction time (when the system recorded it). The governing rule is invalidate, don’t delete: a superseded fact has its interval closed and a new record appended, so the original remains as evidence of what the system believed while it believed it.

The two questions this separates are genuinely different and both get asked in audits: what was this position on 1 July? versus what did we believe this position was on 1 July, as of the analysis we ran that day? The answers legitimately differ when a correction has landed in between, and a single-timestamp store cannot produce both.

There’s a systems reason as well as a compliance reason. A graph that cannot represent when a fact was true will eventually serve an agent two contradictory facts and let it choose, which is among the most common mechanical causes of agent error. Open-source implementations of this pattern are mature; Graphiti is the widely-used reference. And EU AI Act Article 12 requires automatic event logging over the system’s lifetime, with Article 26 obliging deployers to retain those logs for at least six months.

Provenance has to survive graph mutation, which is the part teams underestimate. When two entities merge, the merged entity must inherit source links from both, or a source is silently dropped and lineage is lost. When new data contradicts existing data, that supersession is itself a lineage event.

3.5 Sources as spokes, not integrations

The last support-row element is architectural posture. Adding a new source should be adding a spoke, not commissioning an integration.

The Model Context Protocol has become the plausible default here, and the governance signal matters more than the adoption numbers. Anthropic introduced MCP in November 2024 and donated it to the Agentic AI Foundation (a directed fund under the Linux Foundation) in December 2025, co-founded with Block and OpenAI, with Google, Microsoft, AWS, Cloudflare, GitHub and Bloomberg among members. It stopped being one vendor’s protocol.

On adoption, be careful which numbers you repeat. Anthropic cites more than 10,000 active public servers and roughly 97 million monthly SDK downloads across the Python and TypeScript SDKs. An official registry snapshot in May 2026 counted 9,652 latest server records. For enterprise production use the most defensible source is Stacklok’s 2026 software survey: 29% in limited production and 12% in broad production, 41% combined. Widely circulated figures around 78% enterprise production adoption do not trace to a primary source.

That last sentence is itself the methodology of this series. If a number cannot be traced, it does not go in the deliverable.

4. Worked example: site contracting

Abstract architecture arguments are easy to agree with and hard to act on, so here is one decision, end to end. Clinical trial agreement site contracting, chosen because the stakes are legible, the cycle times are documented, and the authority gradient is unusually sharp.

The problem, in numbers

Contracting is the dominant bottleneck in study start-up. ACRP found that 49% of study start-up delays are caused by contracting and budget negotiations. The CTSA Contracts Processing Study reported average negotiation durations exceeding 100 days for industry-sponsored and investigator-initiated contracts; commentary in ACRP’s Clinical Researcher in April 2025 puts the average above 100 days still, with sites often waiting up to 90 days for compensation and 80% of sites holding less than six months of operating cash. Advarra cites an industry average of 109 days, reduced to 30–45 days through outsourced negotiation.

Standardization demonstrably moves the number: master agreements cut mean full negotiation from 55 to 22 days, and the Accelerated Clinical Trial Agreement developed by 25 academic institutions produced average savings of 40 days across roughly 90 uses, with a reported range from seven days to six months.

One honest caveat, because it illustrates why definitions belong in the vocabulary layer: CRIO’s Site Activation Speed Index reports a median budget negotiation turnaround of 9 days, which appears to contradict everything above. It doesn’t. The 100+ day figures describe the full cycle from protocol receipt to executed contract; the 9-day figure describes budget-revision turnaround once a study is already active. Two different questions wearing the same words. If your semantic layer doesn’t distinguish them, your dashboard is lying to someone.

The blueprint

A site returns a redlined agreement and budget. Today it queues, and is re-read from scratch by whoever picks it up.

Four properties distinguish this from workflow automation:

• The drafting agent selects approved language. It does not write contract prose. Generation is constrained to a library, which is what makes the output reviewable rather than merely plausible.
• Escalation is a rule in the fallback ladder, not a judgment the model makes. Indemnity, IP, publication and subject-injury clauses route to Legal by policy, regardless of model confidence.
• The diff runs against the template version actually executed with that site, not the current library template. This is the single most common source of false positives in contract AI, and it is a data-modeling problem, not a model problem.
• Every agent action lands in the record with its citation. The file survives audit because it was built to.

The authority band never moves down the page as the system improves. A better model makes stages 1–3 faster and more accurate. It does not acquire signature authority.

5. Unit economics are an architecture constraint

A closing point that belongs in a technical article rather than a finance one, because the decisions are made at design time.

Inference is cost of goods sold. ICONIQ’s 2026 data puts average AI-native gross margin at ~52%, against 75–80% for the previous decade of cloud software; Bessemer and a16z land in the same 50–60% range. Inference accounts for 80–90% of a model’s lifetime cost.

But the model invoice is the small part. In one documented lending deployment, token cost was 22% of fully loaded per-transaction cost: tool calls, vector queries, human review and compliance were the other 78%. Practitioner data puts the fully loaded cost of a production GenAI workload at two to four times the foundation-model invoice, and IDC warns that organizations with dedicated FinOps functions still underestimate AI infrastructure cost by up to 30%.

Three design consequences:

1. The authority gradient is also a cost gradient. Steps that don’t require reasoning shouldn’t run through a model. Deterministic rules cost a fraction of an LLM call, and at enterprise volume that difference compounds harder than any prompt optimization.
2. Model routing is the largest single lever. The price spread within one vendor’s lineup runs 5× or more. Routing routine classification to a cheap model and reserving frontier capability for genuinely hard reasoning compresses the bill more than anything else available.
3. Stable context is a margin decision. Cached input tokens carry roughly a 90% discount from the major providers. Beyond correctness, a frozen vocabulary and a stable system context are what make caching possible.

Note the direction of the argument. Every one of those levers is enabled by the discipline in section 3. The support row is what makes the economics work.

6. What to measure

Three metrics, one per layer, each falsifiable:

• Auditability: the proportion of claims that trace to a verified citation against an approved position with a named owner and date. Not “has a link.” Verified.
• Coverage: the answerable ratio, per persona, as a live metric that moves as sources land.
• Fidelity: the proportion of rows in the decision inventory that a member of the relevant persona confirms is a question they actually ask.

That third one is the quiet killer. It is entirely possible to build a technically excellent system on a decision map that no real practitioner recognizes. Fidelity is the only metric that catches it, and it cannot be computed: it has to be asked.

Sources

Service design

• G. Lynn Shostack, Designing Services That Deliver, Harvard Business Review 62(1), Jan–Feb 1984, pp. 133–139; and How to Design a Service (1982).
• Jodi Forlizzi, Service Design Tools Can Inform the Design of Agentic AI Services, December 2025. medium.com
• Zeithaml, Bitner & Gremler, Services Marketing: Integrating Customer Focus Across the Firm.

Autonomy and authority

• K. J. Feng, D. W. McDonald, A. Zhang, Levels of Autonomy for AI Agents, arXiv:2506.12469, June 14, 2025.
• A Governance Framework for Agentic AI Autonomy Levels, arXiv:2607.23438.
• Cloud Security Alliance, Autonomy Levels for Agentic AI, January 28, 2026. cloudsecurityalliance.org

Regulation

• Regulation (EU) 2026/1744 (Digital Omnibus on AI), July 8, 2026, OJ L 2026/1744, published July 24, 2026. EUR-Lex
• EU AI Act (Regulation (EU) 2024/1689), Articles 9, 12, 26, 50.
• FINRA, 2026 Annual Regulatory Oversight Report, December 9, 2025. finra.org
• NIST AI RMF 1.0 and NIST-AI-600-1 Generative AI Profile (July 26, 2024); ISO/IEC 42001:2023.

Semantic layer and determinism

• dbt Labs, Semantic Layer vs. Text-to-SQL: 2026 Benchmark Update; Omni Analytics on text-to-SQL failure modes. Summary

Hallucination and grounding

• M. Dahl, V. Magesh, M. Suzgun, D. E. Ho, Large Legal Fictions, Stanford RegLab / HAI, January 2024: 69–88% hallucination on specific legal queries; >200,000 queries against each of GPT-3.5, Llama 2 and PaLM 2. law.stanford.edu
• V. Magesh et al., Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, Stanford RegLab. Preregistered, 202 queries, hand-scored.

Temporal records

• Bitemporal modeling per SQL:2011 (valid time / transaction time). Graphiti, open-source temporal graph framework. github.com/getzep/graphiti

MCP

• Anthropic, MCP introduced November 2024; donated to the Agentic AI Foundation (Linux Foundation) December 2025. Stacklok 2026 software survey: 29% limited + 12% broad production. Registry snapshot 9,652 records, May 2026. Adoption statistics, with sourcing caveats

Contracting cycle times

• CTSA Contracts Processing Study; Quantitative assessment of the impact of standard agreement templates on multisite clinical trial start up time, PMC10565190. pmc.ncbi.nlm.nih.gov
• ACRP, Improving Study Start-Up Efficiency to Accelerate the Clinical Trial Timeline, February 17, 2026. acrpnet.org
• Advarra and CRIO SASI benchmarks, compiled. IntuitionLabs

Unit economics

• ICONIQ Growth State of AI 2026; Bessemer Venture Partners pricing playbook, February 2026; FinOps Foundation State of FinOps 2026; IDC FutureScape 2026.